**Provably Solving the Hidden Subset Sum Problem via Statistical Learning**

*Jean-Sebastien Coron and Agnese Gini*

**Abstract: **At Crypto '99, Nguyen and Stern described a lattice based algorithm for solving the hidden subset sum problem, a variant of the classical subset sum problem where the $n$ weights are also hidden. As an application, they showed how to break the Boyko et al. fast generator of random pairs $(x,g^x \pmod{p})$. The Nguyen-Stern algorithm works quite well in practice for moderate values of $n$, but its complexity is exponential in $n$. A polynomial-time variant was recently described at Crypto 2020, based on a multivariate technique, but the approach is heuristic only. In this paper, we describe a proven polynomial-time algorithm for solving the hidden subset-sum problem, based on statistical learning. In addition, we show that the statistical approach is also quite efficient in practice: using the FastICA algorithm, we can reach $n=250$ in reasonable time.

**Category / Keywords: **public-key cryptography / Hidden subset-sum problem, lattice attack, statistical attack

**Date: **received 29 Jul 2021

**Contact author: **jscoron at gmail com, agnese gini at uni lu

**Available format(s): **PDF | BibTeX Citation

**Version: **20210803:105937 (All versions of this report)

**Short URL: **ia.cr/2021/1007

[ Cryptology ePrint archive ]